exchange2007证书的中间证书被吊销

2010.6.23，Exchange2007证书的中间证书被吊销了。2010.6.28, 吊销生效了，exchange2007出现了错误。

错误现象：

        1。局域网外部不能通过IE访问网站、手机不能通过WAP同步，即使在IIS中设置为不使用SSL加密都不行。

        2。局域网内部的outlook可以正常使用，IE不加密可以使用。用https的不行。

        3。WINDOWS事件日志中出现12014的错误

日志名称:                    Application
来源:                        MSExchangeTransport
日期:                        2010/6/29 15:10:55
事件 ID:                 12014
任务类别:                    TransportService
级别:                        错误
关键字:                     经典
用户:                        暂缺
计算机:                     mail.a.com.cn
说明:
Microsoft Exchange 无法在本地计算机的个人存储中找到包含域名 mail.a.com.cn 的证书。因此，对于 FQDN 参数为 mail.a.com.cn 的连接器 Default mail，无法支持 STARTTLS SMTP 动词。如果未指定连接器的 FQDN，则将使用该计算机的 FQDN。请验证连接器配置和已安装的证书，以确保存在带有该 FQDN 域名的证书。如果此证书存在，请运行 Enable-ExchangeCertificate -Services SMTP 以确保 Microsoft Exchange 传输服务拥有对证书密钥的访问权限。
事件 Xml:
<Event xmlns= "http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
        <Provider Name="MSExchangeTransport" />
        <EventID Qualifiers="49156">12014</EventID>
        <Level>2</Level>
        <Task>12</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2010-06-29T07:10:55.000Z" />
        <EventRecordID>223041</EventRecordID>
        <Channel>Application</Channel>
        <Computer>mail.a.com.cn</Computer>
        <Security />
    </System>
    <EventData>
        <Data>mail.a.com.cn</Data>
        <Data>Default mail</Data>
    </EventData>
</Event>

 

还有POP服务的错误，都是类似地找不到证书。

 

重新申请证书时，颁发证书CA “由于吊销服务器已经脱机，吊销功能无法检查吊销”，时间紧迫，在确定不能短期内解决颁发证书CA时，紧急部署了第二个颁发证书CA。（这是另外的话题)

 

以下记录exchange2007获取企业证书的过程：

一、在Echange2007上申请

打开Exchange Management Shell ，执行以下命令：

[PS] C:\Windows\System32>get-exchangecertificate

[PS] C:\Windows\System32>New-ExchangeCertificate -GenerateRequest -Path c:\mail0
2_a_com_cn.csr -KeySize 2048 -SubjectName "c=CN,s=XXXXXX,l=XXXXXX, o=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
,cn=mail.a.com.cn" -DomainName mail.a.com.cn,autodiscover.a.com.cn -PrivateKeyExportable $True

Thumbprint                                                                Services     Subject
----------                                                                --------     -------
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXB    .....            C=CN, S=SHEN, L=SHI...

在C：目录下生成了mail_a_com_cn.csr文件

 

 

二、在新的颁发证书CA 上颁发证书

在IIS打开web服务器证书的颁发界面

默认网站--〉certsrv-->右键 浏览--〉申请一个证书--〉高级证书申请--〉使用 base64 编码的 CMC 或 PKCS #10 文件提交 一个证书申请，或使用 base64 编码的 PKCS #7 文件续订证书申请。

打开mail_a_com_cn.csr，把内容拷贝 ，填入。提交后得到一个证书，下载成mail.a.com.cn.cer文件

查看证书链，新的中间证书已经生效了。

 

三、在Exchange2007 ，

用mmc，打开证书服务，个人中的证书、还有被吊销的中间证书全部删除，重新安装新的新的中间证书，默认安装后，新的中间证书出现在中间证书颁发机构中。

把mail.a.com.cn.cer拷贝到C:下

打开Exchange Management Shell ，执行以下命令：

[PS] C:\Windows\System32>Import-exchangecertificate -path "c:\mail_a_com_cn
.cer"

[PS] C:\Windows\System32>get-exchangecertificate

[PS] C:\Windows\System32>enable-exchangecertificate -services "SMTP" 

录入指纹

 

出现错误：

 

Enable-ExchangeCertificate : The certificate with thumbprint XXXXXXXXX was found but is not valid for use with Exchange Server
(reason: PrivateKeyMissing).
At line:1 char:27
+ Enable-ExchangeCertificate <<<< -Thumbprint XXXXXXXXX -Services “SMTP”

 

查了很多资料，其中一篇主张修复，我没有成功。但还是引用如下：

http://customer.globessl.com/knowledgebase/39/PrivateKeyMissing-when-running-Enable-ExchangeCertificate.html

 

PrivateKeyMissing when running Enable-ExchangeCertificate
Enable-ExchangeCertificate : The certificate with thumbprint XXXXXXXXX was found but is not valid for use with Exchange Server
(reason: PrivateKeyMissing).
At line:1 char:27
+ Enable-ExchangeCertificate <<<< -Thumbprint XXXXXXXXX -Services "IIS"

The above error is a result of a glitch with Exchange 2007. This issue does not happen all the time as it is completely random, but when it does happen no certificate can be installed or removed through the Exchange Management Shell (EMS). For whatever reason it may be, the system forgets where it placed the Private Key or the certificate store is damaged.

Repair Damaged Certificate Store:

1) Open MMC (Microsoft Management Console) to the Certificate Manager (Certificates Snap-in) for the Local Computer account.
2) Double-Click on the recently imported certificate (It will be missing the golden key).
3) Go to the Details tab.
4) Click on the Serial Number field and copy down that number. (Leave window open)
5) Open up the command prompt (DOS Prompt -- CMD.exe)
6) Type: certutil -repairstore my "SerialNumber"( SerialNumber is that what was copied down in step 4.)
7) After running the command, go back to the MMC and right-click Certificates and select "Refresh".
8) One should now see the golden key associated with the certificate.
9) Double-check in the Exchange Power Shell with: Get-ExchangeCertificate

Alternatively if the above does not work try the following:    
Note: Follow these steps if running Windows Server 2008 only

1) Open MMC (Microsoft Management Console) to the Certificate Manager for the Local Computer account. (Certificates Snap In)
2) Look in the Personal section of the Certificate Manager and there should be icon(s) without a little golden key. (Those with the key have the private key bonded to them.)
3) Delete the icons without the golden key.
4) Go back to the EMS.
5) Run the Import-ExchangeCertificate and Enable-ExchangeCertificate in one line like so: [ Import-ExchangeCertificate -Path c:\exchange.globessl.com.crt | Enable-ExchangeCertificate -Services "SMTP, IMAP, IIS, POP" ]    
*** Please modify the command according to your needs. ***
6) Things should be golden from here and if they are not, please contact Microsoft.

    

 

还有一篇认为是windows的问题，

http://homerun-networks.com/2009/07/24/privatekeymissing-when-running-enable-exchangecertificate/

Enable-ExchangeCertificate : The certificate with thumbprint XXXXXXXXX was found but is not valid for use with Exchange Server
(reason: PrivateKeyMissing).
At line:1 char:27
+ Enable-ExchangeCertificate <<<< -Thumbprint XXXXXXXXX -Services “IIS”

The above error is a result of a glitch with Exchange 2007. This issue does not happen all the time as it is completely random, but when it does happen no certificate can be installed or removed through the Exchange Management Shell (EMS). For whatever reason it may be, the system forgets where it placed the Private Key or the certificate store is damaged.

Repair Damaged Certificate Store:

1) Open MMC (Microsoft Management Console) to the Certificate Manager (Certificates Snap-in) for the Local Computer account.
2) Double-Click on the recently imported certificate (It will be missing the golden key).
3) Go to the Details tab.
4) Click on the Serial Number field and copy down that number. (Leave window open)
5) Open up the command prompt (DOS Prompt ― CMD.exe)
6) Type: certutil -repairstore my “SerialNumber”( SerialNumber is that what was copied down in step 4.)
7) After running the command, go back to the MMC and right-click Certificates and select “Refresh”.
One should now see the golden key associated with the certificate.
9) Double-check in the Exchange Power Shell with: Get-ExchangeCertificate

Alternatively if the above does not work try the following:
Note: Follow these steps if running Windows Server 2008 only

1) Open MMC (Microsoft Management Console) to the Certificate Manager for the Local Computer account. (Certificates Snap In)
2) Look in the Personal section of the Certificate Manager and there should be icon(s) without a little golden key. (Those with the key have the private key bonded to them.)
3) Delete the icons without the golden key.
4) Go back to the EMS.
5) Run the Import-ExchangeCertificate and Enable-ExchangeCertificate in one line like so: [ Import-ExchangeCertificate -Path c:\exchange.comodo.com.crt | Enable-ExchangeCertificate -Services “SMTP, IMAP, IIS, POP” ]
*** Please modify the command according to your needs. ***


This entry was    

 

 

最后我选择重新申请。

再次执行前面的操作，成功了 ！于是继续执行：

[PS] C:\Windows\System32>enable-exchangecertificate -services "IIS,POP,IMAP"    

 

四、导出证书 为p7b的格式，在防火墙上发布。

在防火墙服务器上先要从证书服务中删除原来的中间证书和颁发证书CA ，在IE中也要删除。

然后安装，发布。测试，成功了！